Collaborate Disseminate
Last week at Ignite in Atlanta Microsoft unveiled their road map for OneDrive for Business and their plans to incorporate the ability to sync SharePoint sites using an updated sync client. That updated preview is now available for download and testin… Continue reading Sync Your SharePoint Sites with new OneDrive for Business Sync Client Preview
Client authentication may be used in a SSL/TLS negotiation.
For this, the client will send a CertificateVerify after the server requested it.
The CertificateVerify message contains the client certificate that will be verified by the server… Continue reading How does a server validate the Certificate Verify message in SSL/TLS?
Imagine that you have a web application that encrypts the user’s data, such as a note or spreadsheet, on both the server and client.
The normal process for a user using this web application is something like this:
The user… Continue reading How To Prove That Client Side Javascript Is Secure?
The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It’s now been deprecated, for rather stupid reasons but that’s besides the point.
So, what are the… Continue reading Alternatives to HTML’s deprecated <keygen> for client certs?
I’m using Socket.IO and the client side looks like this.
<script src=”/socket.io/socket.io.js”></script>
<script>
var socket = io();
socket.emit(“sendData”, “hello!”);
</script>
I’m wondering what’s stopp… Continue reading Can clients visit my site, and spam socket.emit(something); to my server, or is there some security behind socket.io?
How can we identify which root CA client used when there are multiple root CAs on the server?
We can compare the public keys of the client certificate and the root certificate but if we have many root certificates this is an… Continue reading How to identify which root CA does the client certificate use?
Every time that someone mentions eval(), everyone says that there are “security issues” with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug eval() just as well as normal code, and pe… Continue reading What are the security issues with "eval()" in JavaScript?
How do real HTTPS servers validate client certificates? My context is business-to-business rather than regular human clients. I understand basic chain validation to a trusted root CA cert. But do servers typically have some sort of configu… Continue reading SSL/TLS client authentication – practical client cert validation
Suppose I have a server provide a POST URL to send CSR. The response certificate then will be used for later SSL client-cert auth connection.
The problem is anyone can POST a CSR to the server and then the server just sign i… Continue reading How do server know the CSR sender is approved client?
Suppose I have a server provide a POST URL to send CSR. The response certificate then will be used for later SSL client-cert auth connection.
The problem is anyone can POST a CSR to the server and then the server just sign i… Continue reading How do server know the CSR sender is approved client?